427b9db53e2ac3842242ca7d6b00d9bad1969e1c8a40868edae53207d0d4af85

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Size 1.7MB
Sample261017-cwpyzagy6z
SHA256 427b9db53e2ac3842242ca7d6b00d9bad1969e1c8a40868edae53207d0d4af85
MD5 5fa6554e47eeef290afb69e66661f2a0
SHA1 49d8e5d7636cd620c9459046df5532e523450a21
SHA512 4ecf165a81b95365b87e103d16d7b99f96657ba309d440a311d66fbd4fc06053b7fa84808ef36aad337ddc1720587d359cda63331112300569ee95ce3250b70c
SSDEEP 49152:nazlABR14H+xhkQmtsLnvMWs3ZGkA79ieC92pjzkn9AapX:dBAH+zjap
TLSH
T12F855A9C303CE0FE79C998B6D3E3ECC54A3ADAB402A43A654564C2B475AB2F3DD15907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3948	09f7aae31345b7d6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
3792	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Token: SeDebugPrivilege	3948	09f7aae31345b7d6.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3948	3792	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe	90

C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
"C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\ProgramData\439ff0fef98bcd82\09f7aae31345b7d6.exe
  "C:\ProgramData\439ff0fef98bcd82\09f7aae31345b7d6.exe" --launch --wait 600 --owner 3792 --stop-event "Local\2375132ca708ef1bbd426a95d842930e-stop" --lease-mutex "Local\2375132ca708ef1bbd426a95d842930e" --self-delete
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

09f7aae31345b7d6.exe

Path C:\ProgramData\439ff0fef98bcd82\09f7aae31345b7d6.exe
Size 1.5MB
SHA256 e917dee14f33ac10c078d0e2233eff92a91c14524a2d5a1add010c2bd61e4998
MD5 33ef767694c98f92a4fb4fe8c7df1b65
SHA1 f3f5b283df395cd6a1d1a72a4e0b2544661785ab
SHA512 120fe29090ab4eb58750c0f8b20672b735cf06d6cc6f53aa6b48e7f06147fba4ea2c4944861f1254862c7d76c3d4b07c137dd67c5e3edd9f58f230d2f2523669
SSDEEP 12288:EfS9nCYYUP/3rEHdVrFZZQkCSlSjSNvsMuIiQU7zCU4VuBEsQBG/1LYHCQnO6:REHdVr2hSsUB2zCU4VuBEskZX
TLSH
T17B75DB4084B2E45F8DC61C3F52086C6888ECA4AF93622EC7D9E69554CD47BCF6D3BE64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\830df2ab8773fddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 dec352867669124d11a61655a00f17abf1cf5e879915a30d202af0e9e8f0525b
MD5 9f96178249662d5c521c00e13721429d
SHA1 9f54fde54027096f105ee100f2f0fce49aa587e3
SHA512 864db28a742c7ffb294351afb71d1f3f2beb8657a6871e1dad4980143c442f9117dbe8bb3bc0b4dda48e5a369ac80930b9367e4f92a413e6e715afc8052c22a7
SSDEEP 3:yD+nlllGlll/l/lXp9ZjrPBY0Hl2lHe9ivZP:yill0dPBY0oKU
TLSH
T18D53129061820517C482133044C60A403FB953051343042152548170C4EE70004B0184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\830df2ab8773fddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\830df2ab8773fddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1008B
SHA256 5c777da2481d522d5139ba362f76dc222bf880d189081f43e18303d0b286a64a
MD5 694f03efd183585d24ca9e3f609359d1
SHA1 867dc5ea80af396bc4b921ef303330aaf970e604
SHA512 a9d5284135fdaa41af569095b339ad6801c40f9e45bb5a8ba83b18c696e4af8279174d98143c35b3fd43c19c478633e31cba4753da2b8fa8348cc07e8d33bf11
TLSH
T1341112547FCA2DB0F277607091F592691313F10355E59A0D858587264E326064556F59
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-3792.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-3792.log
Size 458B
SHA256 fdbb0b58b3d37810d5db245c8300dd2cc378b7c2f168eaa415d1e1f10cccf5fb
MD5 74c137840556e17643fa877501c8af65
SHA1 83b304b468ab088d26965197d0487fb8edc17cef
SHA512 ffe17bbec6ee311c353c50f9843d960191b8558a454bbfaee57811555ec3f91c7c22ce5d684b87c5369166dbf88dd7adbb103ba08e3d2bba3bbfd8aecbd73197
TLSH
T190F05E7C4CB2A4D4409152176E9C6E0CAEBABA321B0D19D4696DCF50CCC5E03F8984A0
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-3792.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-3792.log
Size 1KB
SHA256 749a0073e7a6b137e399a1c6f52b59f5d8f805b3a2599031305f04d86c733194
MD5 9d5a337be9bb75293b443c20e11191e2
SHA1 e2da7deb11c30b842eab44ad9c8923bffbf4ce2e
SHA512 f772656f2a13031b66e8e44f26b078f2cd4c654943fa09a5e4cb8284747ec73ea9c90c7f93766304dd14a1a77a4cc37dba7f6c21e396d3410e839f636d525a3f
TLSH
T1C221BDBC4CB168E810925216BB5CAE0C6EB7F5721B5D24D87A7CCF50DCC9E13F989490
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3948-29-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-28-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-27-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-25-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-30-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-26-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-21-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download

memory/3948-19-0x000002C1B1630000-0x000002C1B1631000-memory.dmp

Download